MalwareFinancial ServicesFinanceRansomwareData EncryptedIdentity (basic)LowContained

Fonville Morisey

bd_54019f9073c3d460 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 26, 2021

Filed

Dec 29, 2021

To disclose

9 weeks

Affected

3state residents only

Linked

6 filings

Confidence

65%

Full breach record for Fonville Morisey →2 incidents on file

Fonville Morisey notified Montana residents of a ransomware attack occurring Oct 22-28, 2021. Systems storing personal information (names) were encrypted. No indication of data acquisition. Fonville Morisey engaged cybersecurity experts, implemented MFA, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 9 weeks / 64 days

Oct 22, 2021

Begins

Oct 26, 2021

Discovered

Dec 29, 2021

Filed

vs. sector median

+1 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_0f6fc822f918ed792021-12-29Verified
Maine State AGbd_4850ddf6aab1120c2021-12-29Candidate
Massachusetts State AGbd_5ef6d6c08cf9e2242021-12-29Verified
New Hampshire State AGbd_940cc3564615214b2021-12-29Verified

Show 1 more filing ↓

Maine State AGbd_d2d7929302ee525e2021-12-29Verified

Name: Fonville Morisey
norm: fonville morisey

Name: Fonville Morisey
norm: fonville morisey
Industry: Financial Servicesllm

Discovered: Oct 26, 2021
Breach occurred: Oct 22, 2021 – Oct 28, 2021
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 29, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: notified certain state regulators and consumer reporting agencies of this incident as required

During the incident: Engaged leading cybersecurity experts to implement additional safeguards and security protections
Offering you two (2) years of complimentary credit monitoring and identity restoration services with Experian
Notified certain state regulators and consumer reporting agencies of this incident
Changes made: Implemented Multi-Factor Authentication (MFA) on all accounts
Reviewing our policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Indiana State AGDec 29 · first

Maine State AGDec 29 · first

Massachusetts State AGDec 29 · first

New Hampshire State AGDec 29 · first

Maine State AGDec 29 · first

Montana State AGDec 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-21.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2021
Raw hash: 3c7e3acda43ebbb1aa03e2ef6a247c424c51342c51375477bd1c52401d7f608a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityFonville Morisey

Victim entityFonville Morisey

Incidentdiscovered Oct 26, 2021

Stated responseEngaged leading cybersecurity experts to implement additional safeguards and security protections

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov